What’s Vulnerable › Vulnerabilities

CVE-2013-10035: ProcessMaker Open Source < 2.5.2 neoclassic Skin PHP Code Execution

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-07-31 · updated 2026-06-16
• Weakness: CWE-94

Description

A code injection vulnerability exists in ProcessMaker Open Source versions 2.x when using the default 'neoclassic' skin. An authenticated user can execute arbitrary PHP code via multiple endpoints, including appFolderAjax.php, casesStartPage_Ajax.php, and cases_SchedulerGetPlugins.php, by supplying crafted POST requests to parameters such as action and params. These endpoints fail to validate user input and directly invoke PHP functions like system() with user-supplied parameters, enabling remote code execution. The vulnerability affects both Linux and Windows installations and is present in default configurations of versions including 2.0.23 through 2.5.1. The vulnerable skin cannot be removed through the web interface, and exploitation requires only valid user credentials.

Affected products

• ProcessMaker, Inc. ProcessMaker Open Source: from 2.0 before 2.5.2 — fixed in 2.5.2

How to fix

Upgrade to a fixed version: ProcessMaker, Inc. ProcessMaker Open Source 2.5.2. Check the vendor advisory for mitigations.

References

• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/multi/http/processmaker_exec.rb
• https://web.archive.org/web/20150419043936/https://bugs.processmaker.com/view.php?id=13436
• https://www.exploit-db.com/exploits/29325
• https://www.fortiguard.com/encyclopedia/ips/37390
• https://www.vulncheck.com/advisories/processmaker-open-source-neoclassic-skin-php-code-execution

Get alerted when CVE-2013-10035 or the next vulnerability affects your stack